IN THE CLAIMS: 

This listing of claims will replace all prior versions, and listing, of claims in the application. 
Listing of the Claims: 

1 . (Currently amended) A computer-implemented method for detection of items stored in a 
computer system such as computer code, data or information characteriz e d in that it 
comprises , the method comprising obtaining (43) a signature by reading code comprising 
at least part of a program capable of introducing the items, the code incorporating 
sufficient data to characterise the program adequately, using the code as the signature, 
comparing (90) the signature with files stored on the computer system, and, if a match 
with the signature is found, providing an indication thereof (96). 

2. (Currently amended) A method according to Claim 1 charact e ris e d in that wherein the 
indication incorporates an identification of at least one of 

a) an item responsible for the match, 

b) the nature of the item, 

c) the item's location in the computer system, and 

d) the matching signature. 

3. (Currently amended) A method according to Claim 1 charact e ris e d in that wherein the 
items are steganographic items. 

4. (Currently amended) A method according to Claim 1 charact e ris e d in that wherein the 
code that is read is one of the following: 

a) a continuous sequence of program code; 

b) a continuous sequence of program code and beginning where its program begins, 

c) a continuous sequence of program code but not more than 5% and not less than 
0.167% of its program's code; 

d) a program kernel; 

e) a .DDL or .ocx file; and 
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f) code implementing both write to and read from a file. 

5. (Currently amended) A method according to Claim 1 charact e ri se d in that wh e rein 
asserted file type is ignored when comparing (90) files with the signature. 

6. (Currently amended) A method according to Claim 1 charact e ris e d in that wherein the 
step (90) of comparing the signature with files is for each file preceded by checking the 
respective real file type by reading the start of the file and excluding files having 
prearranged initial byte sequences from comparing with the signature. 

7. (Currently amended) A method according to Claim 1 charact e ris e d in that wherein files 
not accessible by a system administrator are excluded from comparison with the 
signature. 

8. (Currently amended) A method according to Claim 1 charact e ris e d in that wherein files 
compared with the signature include logical wastebasket files deleted files and 
compressed files. 

9. (Currently amended) A method according to Claim 1 charact e ris e d in that wherein files 
compared with the signature include self-extracting executable files and polymorphic 
files. 

10. (Currently amended) A method according to Claim 1 charact e ris e d in that wherein in 
respect of some prearranged files no indication as aforesaid is given despite their 
containing code which matches a signature. 

1 1 . (Currently amended) Computer apparatus for detection of stored items such as computer 
code, data or information, charact e ris e d in that the apparatus is being programmed to: 

a) obtain £4-8) a signature by reading code comprising at least part of a program 
capable of introducing the items, the code incorporating sufficient data to 
characterise the program adequately, 
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b) use the code as the signature, 

c) compare (90) the signature with files stored on the computer apparatus, and 

d) if a match with the signature is found, providing an indication thereof (96). 

12. (Currently amended) Apparatus according to Claim 11 charact e rised in that wherein the 
indication incorporates an identification of at least one of: 

a) an item responsible for the match, 

b) the nature of the item, 

c) the item's location in the computer system, and 

d) the matching signature. 

13. (Currently amended) Apparatus according to Claim 11 charact e ris e d in that wherein the 
items are steganographic items. 

14. (Currently amended) Apparatus according to Claim 11 charact e ris e d in that wherein the 
code of the signature is one of the following: 

a) a continuous sequence of program code; 

b) a continuous sequence of program code and beginning where its program begins, 

c) a continuous sequence of program code but not more than 5% and not less than 
0.167% of its program's code; 

d) a program kernel; 

e) a .DDL or .ocx file; and 

f) code implementing both write to and read from a file. 

15. Apparatus according to Claim 1 1 charact e rised in that it is programmed to ignore asserted 
file type when comparing files with the signature. 

16. Apparatus according to Claim 11 charact e rised in that b e for e comparing (90) — the 
signatur e with fil e s it i s programmed to check for each file the respective real file type by 
reading the start of the file and excluding files having prearranged initial byte sequences, 
and to check as aforesaid before comparing the signature with files . 
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17. (Currently amended) Apparatus according to Claim 11 charact e rised in that it is 
programmed to exclude files not accessible by a system administrator from comparison 
with the signature. 

18. (Currently amended) Apparatus according to Claim 11 charact e rised in that it is 
programmed to compare (90) with the signature logical wastebasket files, deleted files 
and compressed files. 

19. (Currently amended) Apparatus according to Claim 11 charact e ri se d in that it is 
programmed to compare (90) with the signature self-extracting executable files and 
polymorphic files. 

20. (Currently amended) Apparatus according to Claim 11 charact e ris e d in that it is 
programmed (72, 7 4 ) to give no indication as aforesaid in respect of some prearranged 
files despite their containing code which matches a signature. 

21. (Cancelled) 

22. (Currently amended) A computer software product according to Claim 24- 31 
charact e ris e d in that wherein the indication incorporates an identification of at least one 
of 

a) an item responsible for the match, 

b) the nature of the item, 

c) the item's location in the computer system, and 

d) the matching signature. 

23. (Currently amended) A computer software product according to Claim 24* 31 
charact e ris e d in that wherein the items are steganographic items. 

24. (Currently amended) A computer software product according to Claim 24- 31 
charact e ris e d in that wherein the signature is one of the following: 

a) a continuous sequence of program code; 
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b) a continuous sequence of program code and beginning where its program begins, 

c) a continuous sequence of program code but not more than 5% and not less than 
0.167% of its program's code; 

d) a program kernel ; 

e) a .DDL or .ocx file; and 

f) code implementing both write to and read from a file. 

25. (Currently amended) A computer software product according to Claim 24- 31 
charact e ris e d in that it contains wherein the instructions for controlling provide for the 
computer apparatus to ignore asserted file type when comparing files with the signature. 

26. (Currently amended) A computer software product according to Claim 24- 31 
charact e ris e d in that it contains wherein the instructions for controlling computer 
apparatus to check real file type by reading the start of the file and exclude files having 
prearranged initial byte sequences from comparison with the signature, and to do so prior 
to comparing the signature with files. 

27. (Currently amended) A computer software product according to Claim 24* 31 
charact e ris e d in that it contains wherein the instructions for controlling provide for the 
computer apparatus to exclude from comparison with the signature files not accessible by 
a system administrator. 

28. (Currently amended) A computer software product according to Claim 24- 31 
charact e rised in that it contains wherein the instructions for controlling provide for the 
computer apparatus to compare (90) with the signature logical wastebasket files, deleted 
files and compressed files. 

29. (Currently amended) A computer software product according to Claim 24- 31 
characterised in that it contain s wherein the instructions provide for the computer 
apparatus to compare (90) with the signature self-extracting executable files and 
polymorphic files. 
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30. (Currently amended) A computer software product according to Claim 24- 31 
charact e ris e d in that its wherein the instructions provide for the computer apparatus to 
give no indication as aforesaid in respect of some prearranged files despite their 
containing code which matches a signature. 

31. (New) A computer software product comprising a computer readable medium 
containing computer readable instructions for controlling operation of computer apparatus 
to implement detection of items stored in a computer system such as computer code, data 
or information, wherein the computer readable instructions provide a means for 
controlling the computer apparatus to: 

a) obtain a signature by reading code comprising at least part of a program capable of 
introducing the items, the code incorporating sufficient data to characterise the 
program adequately, 

b) use the code as the signature, 

c) compare the signature with files stored on the computer apparatus, and, 

d) if a match with the signature is found, to provide an indication thereof. 
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